CIOs massively underestimate Secure Shell risks - study

New research has revealed chief information officers are massively underestimating Secure Shell risks.

Machine identity management provider Venafi have released a new report offering insights into the security risks that poorly protected Secure Shell machine identities pose to enterprises. The report compares findings from a survey of 550 CIOs from the United States, United Kingdom, France, Germany and Australia, with unique data and insights from aggregate SSH risk assessments conducted by Venafi SSH security experts.

SSH machine identities are critical to digital transformation strategies, as they authenticate privileged access between machines and are ubiquitous across enterprise networks.

While CIOs say they are concerned about the security risks SSH machine identities pose, Venafi data indicates they seriously underestimate the scope of these risks.

To better understand the scale of this problem, Venafi surveyed over 550 global CIOs and then compared the survey data with aggregate SSH risk assessments conducted over a two-year time period. The Venafi Risk Assessment team analysed more than 14 million SSH client keys and 3.3 million SSH host keys and found serious SSH security risks.

The report found 80% of CIOs say they are concerned about the security risks connected with SSH keys, while 68% recognise managing SSH will only become more difficult as organisations move to modern, cloud-native environments.
 
Enterprises average 2.5 root access keys per server analysed. Root access keys provide the highest levels of access to machines; if a threat actor gains access to root privileges, they can access anything on a remote server, or on multiple servers if the server has been cloned.
 
According to the report, 96% of CIOs say their policies require the removal of keys when employees are terminated or transferred, but 40% admit they don't have automated tools to remove unused keys.
 
Enterprises have, on average, more than 7000 root access orphan keys, or at least one root access orphan per every server analysed. Root access orphan keys bring great security risks for organisations because they can create persistent back doors into networks that can last for months or years.
 
Enterprises average 2 duplicate private keys and one shared private key per each server analysed. A large number of duplicate private keys stems from ineffective or nonexistent enforcement of policies governing the duplication of private keys and limitations on where they are stored.
 
"SSH keys are extremely powerful assets that require careful protection," says Kevin Jacque, global security architect for Venafi.

"It's not surprising to find so many severe security risks because we know that most organisations do not use any automation to manage them," he says.

"Unfortunately, we should expect these gaps in SSH key management to continue to grow as organisations move more workloads to the cloud where SSH keys are used for nearly everything. The only way to address these risks is to put in place a comprehensive SSH machine identity management solution that provides continuous visibility and leverages automation to enforce policies.